Subject: [Ipsec] According to RFC 4301: Is a packet always consulting the SPD first?

From: "Christian Kaas-Petersen \(AH/LMD\)" <[email-masked]>
Date: Fri, 16 Mar 2007 10:52:42 +0100

I have a question below.

+----+
|    |   |
| H1 |---|
|    |   |
+----+   |                        IPv4
         | eth1+----------+                  +-----+   +----+
         |-----|          | eth3             |     |   |    |
         |     |          |-----             |R    |---| H2 |
               |          |       Inter  ----|SG   |   |    |
IPv6 domain    |  R-SG-I  |                  |II   |   +----+
           eth2|          | eth4             |     |
            |  |          |-----             +-----+  IPv6 domain
  +----+    |--|          |        net
  |    |    |  +----------+
  | H3 |----|
  |    |    |
  +----+    |
            |
            |

Assume R-SG-I is a combined router and security gateway.  It has
four interfaces. Two of the interfaces, eth1 and eth2, belongs to
a protected IPv6 domain within which IPv6 hosts H1 and H3 are
found.  The other two interfaces, eth3 and eth4, belong to an
unprotected IPv4 domain.

Assume R-SG-II is another combined router and security gateway
with host H2 in the protected IPv6 domain.

Finally IPsec SAs have been established between R-SG-I and
R-SG-II over the IPv4 network, such that IPv6 packets in transit
between the two protected IPv6 networks are tunneled using
ESP in tunnel mode.

QUESTION: When an IPv6 packet from host H1 destined to host H2
arrives at R-SG-I, how is the packet processed by R-SG-I?

One choice is to say, that all IPv6 packets (both packets from
H1 to H2 and packets from H1 to H3) consult the SPD, from
which it is found that the packet shall be
ESP-encapsulated. This ESP-encapsulated packet has (outer)
IPv4 addresses, and a subsequent lookup in the IPv4 forwarding
table decides the outgoing interface.

Another choice is to say, that the IPv6 packet from H1 to H2
consults the IPv6 forwarding table to find out whether
the packet is required crossing the IPsec boundary, ie decided
if it is an outbound packet.  The packet from H1 to H2
is by the forwarding table marked as an outbound packet, and
only then the packet consults the SPD.  The motivation for the
lookup in the IPv6 forwarding table first, is that a packet
from H1 to H3, which will traverse only the protected network
is never a candidate for crossing any IPsec boundary,
and should therefore not consult the SPD.  Even though an SPD
entry with action BYPASS doesn't change the packet, it does
at least conceptually move the packet from protected to
unprotected network, but the IPv6 network is protected.

The use of IPv6 is used just to simplify (I hope) the
description on what is protected and what is unprotected.
Private IPv4 addresses in the protected part and public
IPv4 addresses in the unprotected part could have been
used just as well.

Christian

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: <[email-masked]>
Date: Fri, 16 Mar 2007 12:31:04 +0200

Hi,

RFC 4301 describes how packets crossing a (logical) "IPsec boundary"
are processed, but it does not specify where exactly that boundary
must be placed. In particular, the protected and unprotected
"interfaces" are logical constructs that don't necessarily map
one-to-one to physical things called by the same name (or even what
your favourite OS would call "interfaces"). Also, a single physical
box might well have more than one logical IPsec boundary.

So I'd say both alternatives you describe (for placing the IPsec 
boundary/boundaries) could be consistent with RFC 4301.

Best regards,
Pasi

> -----Original Message-----
> From: ext Christian Kaas-Petersen (AH/LMD) 
> [mailto:[email-masked]] 
> Sent: 16 March, 2007 11:53
> To: [email-masked]
> Subject: [Ipsec] According to RFC 4301: Is a packet always 
> consulting theSPD first?
> 
> I have a question below.
> 
> 
> 
> 
> +----+
> |    |   |
> | H1 |---|
> |    |   |
> +----+   |                        IPv4

---

From: Stephen Kent <[email-masked]>
Date: Fri, 16 Mar 2007 10:59:42 -0400

Christian,

>...

As Pasi noted in his message, 4301 says that one defines an IPsec 
boundary in the device implementing IPsec, and then applies IPsec 
processing to all traffic that attempts to cross the boundary. So, 
depending on where you you draw the boundary, that will determine 
which processing model is applied. In your diagram it might make 
sense to draw the boundary so that only traffic attempting to cross 
the Internet (vs. the LAN behind R-SG-1) is subjected to IPsec 
processing. However, if you wanted R-SG-1 to also mediate traffic 
flow between the eth1 and eth2 LANs, you could draw the boundary to 
enforce that.

Steve